System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

SSH server timeouts

Updated: September 18, 2026

Want to summarize with AI?

Explains how separate connection and channel timers release inactive SSH resources on Cisco IOS XR routers while preserving active connections and independent management operations.

SSH server timeouts are resource-management controls that

terminate connections that have no active channels
close individual channels that stop sending or receiving data, and
prevent inactive SSH state from consuming session resources indefinitely.

A connection is the encrypted client-server session that supports authentication and data exchange. A channel is an independent virtual path inside that connection for an operation such as a shell, SFTP, or NETCONF session.

Timeout comparison

Table 1. SSH timeout behavior
Timeout	Timer starts	Result
Connection	All channels close and no new channel opens.	The router terminates the complete SSH connection.
Channel	A channel has no data activity for the configured period.	The router closes the idle channel while retaining the parent connection.

Unused SSH connection timeouts

An unused SSH connection timeout is a server setting that

starts when all channels in a connection are closed
terminates the connection if no new channel opens before expiry, and
prevents stale automation connections from exhausting session resources.

SSH connections persist after authentication and can host multiple channels for management or file-transfer operations. The connection timer does not run while an active channel remains open.

Table 2. Feature History Table
Feature Name	Release Information	Feature Description
Unused connection timeout for SSH sessions	Release 25.3.1	You can prevent session limit exhaustion and maintain optimal system performance by automatically disconnecting SSH connections with no active channels. The feature introduces a configurable timeout for unused SSH connections, ensuring stale sessions do not occupy resources on your routers. The router monitors each SSH connection and terminates it when all channels remain closed and SSH clients do not create new channels within the configured timeout period. The feature introduces these changes: CLI: ssh server timeout YANG Data Models: `Cisco-IOS-XR-crypto-ssh-cfg.yang` data model was modified. `Cisco-IOS-XR-um-ssh-cfg.yang` data model was modified. (see GitHub)

Set the unused SSH connection timeout

Disconnect stale SSH connections automatically to protect session capacity and system resources.

Procedure

Set the unused-connection timeout to 600 seconds and commit the configuration.
Example:
```
Router# configure
Router(config)# ssh server timeout connection 600
Router(config)# commit
```
The timer begins when all channels in the connection close and no new channel opens.

Verify the configured connection timeout.

Example:

Router# show run ssh
ssh server timeout
 connection 600
Router# show ssh server
Connection Timeout := 600

Monitor the SSH session before and after timeout expiry.

Example:

Before timeout expiry:

Router# show ssh
SSH version : Cisco-2.0 

id       chan pty     location        state           userid    host          ver authentication connection type
-----------------------------------------------------------------------------------------------------------------------
Incoming sessions
2         0   vty0    0/RP0/CPU0      SESSION_OPEN    cisco     198.51.100.1  v2  password       Command-Line-Interface 

Outgoing sessions

After timeout expiry:

Router# show ssh
SSH version : Cisco-2.0 

id       chan pty     location        state           userid    host          ver authentication connection type
-----------------------------------------------------------------------------------------------------------------------
Incoming sessions
2         0   XXXXX   0/RP0/CPU0      SESSION_OPEN    cisco     198.51.100.1  v2  password                              

Outgoing sessions

When the connection timeout expires and entire connection closes:

Router# show ssh
SSH version : Cisco-2.0 

id       chan pty     location        state           userid    host                  ver authentication connection type
-------------------------------------------------------------------------------------------------------------------------------
Incoming sessions

Outgoing sessions

While an active channel exists, the connection type identifies that channel and the connection timer does not trigger. When no channel is active, the connection type becomes blank. After expiry, the connection no longer appears under incoming sessions.

Check the console log for termination of the inactive connection.

Example:

%SECURITY-SSHD_SYSLOG_PRX-6-INFO_GENERAL : sshd[42522]: terminating inactive connection from user sample-user 198.51.100.1 port 25372

The router automatically disconnects unused SSH connections after the configured timeout period.

SSH channel timeouts

An SSH channel timeout is a server setting that

monitors each channel for data inactivity
closes a channel when its configured idle period expires, and
retains the parent SSH connection for other active or future channels.

Channels are independent virtual paths within one SSH connection and support concurrent operations such as shell access and file transfer. The timeout applies to all channel types, including Shell, SFTP, and NETCONF.

Table 3. Feature History Table
Feature Name	Release Information	Feature Description
Channel timeout for SSH sessions	Release 25.3.1	You can improve resource efficiency and minimize potential security risks by automatically closing idle SSH channels on the routers after a specific period of inactivity. The feature introduces a configurable timeout for SSH channels which ensures that unused channels do not persist while the parent SSH connection remains active. The router monitors each SSH channel and closes any channel where no data is sent or received within the configured timeout period. The feature introduces these changes: CLI: ssh server timeout YANG Data Models: `Cisco-IOS-XR-crypto-ssh-cfg.yang` data model was modified. `Cisco-IOS-XR-um-ssh-cfg.yang` data model was modified. (see GitHub)

Set the SSH channel timeout

Close inactive SSH channels automatically to improve resource efficiency and reduce security exposure.

Procedure

Set the SSH channel timeout to 300 seconds and commit the configuration.
Example:
```
Router# configure
Router(config)# ssh server timeout channel 300
Router(config)# commit
```
The timer expires when a channel remains idle for the configured period.

Verify the configured channel timeout.

Example:

Router# show run ssh
ssh server timeout
 channel 300
 connection 600
Router# show ssh server

Compare the SSH session before and after channel timeout expiry.

Example:

Before timer expiry:


Router#show ssh

SSH version : Cisco-2.0 

id       chan pty     location        state           userid    host             ver authentication connection type
--------------------------------------------------------------------------------------------------------------------------
Incoming sessions
8         0   vty0    0/RP0/CPU0      SESSION_OPEN    user1     198.51.100.1     v2  password       Command-Line-Interface 

Outgoing sessions
Router#

After timer expiry:


Router#show ssh

SSH version : Cisco-2.0 

id       chan pty     location        state           userid    host             ver authentication connection type
--------------------------------------------------------------------------------------------------------------------------
Incoming sessions
8         0   XXXXX   0/RP0/CPU0      SESSION_OPEN    user1     198.51.100.1     v2  password                              

Outgoing sessions
Router#

Before timer expiry, the output identifies the active pseudoterminal and connection type. After expiry, the pty field displays XXXXX and the connection type is blank.

Check the console log for closure of the idle channel.

Example:

%SECURITY-SSHD_SYSLOG_PRX-6-INFO_GENERAL : sshd[39648]: Closing channel 0 of user sample-user 198.51.100.1 port 34454 after 300 seconds of inactivity

The router automatically closes inactive SSH channels after the configured timeout while the parent connection remains available.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.